Microsoft Lync version 4.0.7577.0 is vulnerable to a javascript injection
vulnerability.

2. Description

Javascript commands can be stacked within the url in the “reachLocale”
variable in ReachJoin.aspx. Arbitrary javascript can be inserted, with
some restrictions (notably that characters such as “>” will invoke .NET
security protections and cause the page to fail to display)

3. Proof of Concept

The following URL will load an image in a new window or tab, as well as
display an alert with arbitrary content:

Pop-ups will need to be enabled in order to load a new tab, but this can be
circumvented by social engineering (i.e. a dialog box) or possibly by more
clever javascript insertion.

4. Impact

Exploiting this attack allows an adversary to inject most types of
Javascript into the page and in order to execute client-side attacks or
perform social engineering attacks. These attacks can easily be manipulated
to compromise a target workstation.

5. Affected Products

Only version 4.0.7577.0 has been tested. This vulnerability may exist in
other versions.

6. Solution

According to Microsoft, the vulnerability can be resolved by updating with
the “update package for Lync Server 2010, Web Components Server: April 2011″
at http://support.microsoft.com/kb/2500441